- [Instructor] SQL server express
comes as a free download for windows 10.
I've got it installed on my windows 10 system,
so let's go to the SQL server management studio.
I'll take the default, SQL express instance,
which in my case is shuttle SQL express.
And we now have access to the instance
in the management console.
Let's make sure we set up to use transactional queries,
let's select tools, options,
query execution, SQL server, general,
and check the box by default,
open new queries in SQL command mode and okay.
Let's also right click
on the shuttle SQL express connection and select facets.
We'll change the dropdown to service security
and set XP command shell enabled
to true, okay, okay.
Ignore the message about server agents
and close the dialogue.
We can make a new database by right clicking databases
and then entering the name Cleo.
New database, Cleo, okay.
And if we expand databases, we can see we have Cleo.
We can import our Pharos table
by right clicking on the Cleo database,
selecting tasks import flat file
and we'll specify the input file,
which we have in our exercise folder.
We'll click next and next
and we'll set up the column names,
which are Phid
and which will make a small lint.
Name, make the verchar to two.
We'll put reign start,
we'll just leave it as that.
Reign end, dynasty and tomb as verchar eight.
I won't bother with keys
so we can just click next and finish, and close.
Now we can use our windows command shell
to execute transactional queries on the database.
We, the SQL command program to connect to the SQL instance.
Let's see what databases we have.
Select name from sys dot databases, go
and we list our databases.
Let's use our Cleo database.
Use Cleo, go.
We can run a union select on this.
Select name, from pharaoh
union, select testing, go
and when we get the results.
Note the entry testing
is in sort order in the results.
We can access SQL server system names.
Select no from pharaoh
union select quote dollar bracket, SQLCMD user
to get our current user bracket quote, go,
and we get our username, which is user.
If the instance
has the command shell extended procedure configured,
we can use this to run system commands.
Execute, XP, command shell,
who am I, go and where NT service MSSQL dollar, SQL express.
If we encounter errors with command shell,
it may be because it's not enabled.
However we can enable it, if we're a sys admin.
Let's see how we check, if we're a sys admin.
We do this with select,
no from Pharaoh union select
is server role member, sys admin, go
and we get a zero and a one back,
the zero is the integer interpretation of the blank field
and one is the sys admin flag.
Indeed, we are a sys admin.
Now, if we want to enable XP command shell,
we can do that with four commands.
Execute, SP, configure show advanced options, comma one.
Reconfigure, execute, SP
configure XP, command shell, comma one,
reconfigure and go.
In our case,
we see that command shell has changed from one-to-one,
we were already enabled for it.
We can't use the XP command shell directly in the union,
but if we have a multiline option on,
then we can add it to the end of the line.
Select no from pharaoh
union select no execute,
XP command shell,
dir C code on slash users and go,
and we get our directory listing out.
There are other ways to access system capabilities.
For example, using the cyst DMOS
enumerate file system functions
to list text files.
We'll go and we found a user dot text file
our normal pen testing flag.
There are many of the cysts stored
in extended procedures in SQL server,
but these contend to be somewhat unreliable.
Nevertheless, it's worth spending
a bit of time exploring them.